Solana Wallets Targeted by Address Poisoning
Nearly 4.5 million wallets were affected by a campaign that tricked users into sending funds to fraudulent addresses.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you trust your own ability to verify cryptocurrency addresses before sending payments?
Between October 2025 and October 2026, address poisoning scams targeted 4,497,798 Solana wallets by inserting fake addresses into transaction histories. These lookalike scams caused 1,104 users to lose at least $940,106 in cryptocurrency.
Why it matters
The scam relies on users copying addresses from their transaction history, leading them to inadvertently send funds to attackers instead of legitimate recipients. This highlights a significant security vulnerability for users who rely on convenience over verifying full address strings.
The poisoning technique involves sending a tiny dust transfer to a wallet to place a scammer's address near a legitimate one in the payment history. Attacks occurred across 4,497,798 Solana wallets, with specific instances involving losses of $30,749.80 USDT.
The players
Bitquery
This is a blockchain data and infrastructure company that specializes in parsing and analyzing large-scale distributed ledger transactions.
Phantom
This organization develops a popular multi-chain crypto wallet that operates extensively on the Solana blockchain.
Solana
This is a high-performance blockchain platform known for its low transaction costs and support for decentralized applications.
The details
Scammers exploit the common practice of copying past addresses from transaction logs, where the attacker's lookalike address appears just seconds after a legitimate transaction. Phantom has advised users to stop copying addresses directly from their transaction histories to avoid these fraudulent redirects.
Timeline
October 30, 2025 – October 7, 2026: Period during which 4,497,798 Solana wallets were targeted.
November 17, 2025: A user lost $30,749.80 USDT following a test transfer to a fake address.
July 9, 2026: End date for the subset used in the analysis of lost funds.
October 9, 2026: Bitquery released the findings regarding the address poisoning campaign.
The Tech Race
This poisoning campaign reflects the ongoing challenge of securing user-facing interfaces against sophisticated social engineering tactics. As decentralized finance platforms evolve, this attack marks a departure from traditional hacking methods by targeting the user's workflow rather than the network protocol.
Users can mitigate risk by never copying addresses directly from their transaction history logs and instead manually verifying the full address string. This practice adds a layer of caution that prevents accidental transfers to lookalike accounts generated by scammers.
The takeaway
Always double-check every character of a destination address before confirming a crypto transaction to ensure it matches the intended recipient. Relying on history logs for addresses is a primary vector for theft and should be avoided in favor of manual entry or saved contact lists.
Further reading
For more information on protecting your digital assets, visit the Cybersecurity section.
Live Poll
Do you trust your own ability to verify cryptocurrency addresses before sending payments?
